3 ms·

For v7.3.2, SHA1 for original SciLexer.dll: x86: D7F9B9FD1459EDF6B417244E14EB5D734A973914 x64: 506F6CE3F09BFD1B0A982F2E6ECCBA397FD07BC2 1. Downloaded .bin.zi

For v7.3.2, SHA1 for original SciLexer.dll: x86: D7F9B9FD1459EDF6B417244E14EB5D734A973914 x64: 506F6CE3F09BFD1B0A982F2E6ECCBA397FD07BC2 1. Downloaded .bin.zip and .bin.x64.zip from https://notepad-plus-plus.org/download/v7.3.2.html https://notepad-plus-plus.org/download/v7.3.2.html 2. Verified sha1 against https://notepad-plus-plus.org/repository/7.x/7.3.2/npp.7.3.2.sha1.md5.digest.txt https://notepad-plus-plus.org/repository/7.x/7.3.2/npp.7.3.2... (for posterity: E32326B860815688302DF006C37395F13E24AABD and C81E940B04BAF11DE485068D9DCA4CD5CCE0E418) 3. Extracted SciLexer.dll from zips 4. Generated sha1 of SciLexer.dll Note: The machine I tested this already had v7.3.2 installed. The hash of SciLexer.dll from my (x86) install matches the above, but independent verification is recommended over taking my word for it.

hashflash 10y ago
This is for 7.3.3+
- Arnavion 10y ago
  >This is for 7.3.3+ v7.3.2 is the latest version without the cert check, and is thus the latest possibly vulnerable version.
pryce 10y ago
Don't use SHA1..
- Arnavion 10y ago
  You'd rather I used MD5? Because those two are the only ones the NPP download manifest page provides.
  - pryce 10y ago
    Of course not. But if (as in this case) we're trying to mitigate, broadly, against a threat with the resources[1] of the CIA, SHA1 should be considered completely inappropriate now, even though the recent SHA1 announcement was with respect to collisions rather than a preimage attack. Surely requesting they post SHA256 hashes is the appropriate step? [1] obviously after the leaks this specific attack is more likely to be coopted by many additional actors, but I don't think that's enough to explode my point.
    - tripzilch 10y ago
      > but I don't think that's enough to explode my point No, however the part where they produced a collision and not a pre-image attack, is :) We should be moving away from SHA1, but it's unlikely that they're hoarding a pre-image attack on SHA1 and have spent the (probably rather large) amount of resources to produce one for this DLL in particular.
canada_dry 10y ago
I'm curious to know whether virustotal detects the infected dll. My tin foil hat thinks no.

hashflash 10y ago

This is for 7.3.3+

Arnavion 10y ago
>This is for 7.3.3+ v7.3.2 is the latest version without the cert check, and is thus the latest possibly vulnerable version.

pryce 10y ago

Don't use SHA1..

Arnavion 10y ago
You'd rather I used MD5? Because those two are the only ones the NPP download manifest page provides.
- pryce 10y ago
  Of course not. But if (as in this case) we're trying to mitigate, broadly, against a threat with the resources[1] of the CIA, SHA1 should be considered completely inappropriate now, even though the recent SHA1 announcement was with respect to collisions rather than a preimage attack. Surely requesting they post SHA256 hashes is the appropriate step? [1] obviously after the leaks this specific attack is more likely to be coopted by many additional actors, but I don't think that's enough to explode my point.
  - tripzilch 10y ago
    > but I don't think that's enough to explode my point No, however the part where they produced a collision and not a pre-image attack, is :) We should be moving away from SHA1, but it's unlikely that they're hoarding a pre-image attack on SHA1 and have spent the (probably rather large) amount of resources to produce one for this DLL in particular.

canada_dry 10y ago

I'm curious to know whether virustotal detects the infected dll. My tin foil hat thinks no.